Bitget hack: $387.5M lost via zero-day and stolen admin credentials

On September 24, 2026, crypto exchange Bitget lost roughly $387.5 million after attackers chained a zero-day in a third-party security product with stolen privileged credentials to inject fraudulent withdrawal commands into its wallet backend. About $269 million was consolidated into Bitcoin via THORChain, while only ~$840,000 (0.2%) was frozen.

• 17 large withdrawals across Ethereum, TRON, BNB Chain, Base and others between 18:58 and 20:09 UTC
• Initial loss estimate of $351.6M was later revised to $387.5M
• About $269M consolidated into Bitcoin via THORChain, another $37.27M via Chainflip
• Loss absorbed by the ~$465M User Protection Fund, to be replenished to at least $300M